Re: byte_test and relative

[Todd Wease <twease () sourcefire com>]

On Fri, Nov 2, 2012 at 2:20 PM, Brandon Castel <bcastel () wurldtech com>wrote:

> Thanks Todd, that's roughly what I ended up coming up with. I think what
> confused me is that the docs say "relative to the last pattern match" in
> a lot of places which I guess I interpreted wrong. I did notice though
> that asn1: relative_offset <x> says that it can be relative to any of
> content, byte_test, or byte_jump... is that just an error in the docs or
> something unique to ASN.1?

Looks like that's an error in the docs.  I'll write a bug to get that
updated to remove byte_test.  Thanks.

------------------------------------------------------------------------------
LogMeIn Central: Instant, anywhere, Remote PC access and management.
Stay in control, update software, and manage PCs from one command center
Diagnose problems and improve visibility into emerging IT issues
Automate, monitor and manage. Do more in less time with Central
http://p.sf.net/sfu/logmein12331_d2d

_______________________________________________
Snort-devel mailing list
Snort-devel () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-devel
Archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel

Please visit http://blog.snort.org for the latest news about Snort!